@aglyn/aglyn 1.0.0-beta.200 → 1.0.0-beta.201

package/src/lib/app-utils/payment-risk.js

@@ -0,0 +1,139 @@
+import { _ as _extends } from "@swc/helpers/_/_extends";
+/**
+ * @license
+ * Copyright 2026 Aglyn LLC
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */ /*==========================================
+ * PAYMENT RISK ON A MERCHANT'S RECORD (AGL-3360).
+ *
+ * Stripe tells us three ways that a card may not be its holder's: an
+ * issuer's EARLY FRAUD WARNING, a Radar REVIEW that holds the payment, and a
+ * DISPUTE. For a site's own sale — an order, a booking, a membership — the
+ * merchant is the one who decides what to do about it, so the signal lands
+ * on the record the sale belongs to, in the merchant's own workspace.
+ *
+ * This is the one shape every plugin stamps (`paymentRisk` on its own
+ * document) and the one sentence every plugin renders, so an order chip and
+ * a booking chip say the same thing about the same event. Pure and
+ * client-safe; the server write is `payment-risk-record.ts` in
+ * tenant-data-admin.
+ *
+ * Nothing here moves money. An early fraud warning is not yet a chargeback,
+ * a review can clear, and a dispute can be won: the words tell the merchant
+ * what arrived and where to act (Stripe), never that anything was refunded.
+ *=========================================*/ import { PLATFORM_BRAND_NAME } from "./platform-brand.js";
+export const PAYMENT_RISK_FIELD = 'paymentRisk';
+/** Bounded so a pathological charge cannot grow a document without end. */ const MAX_SIGNALS = 20;
+/** The Stripe events that carry a signal, and which kind each is. */ export const PAYMENT_RISK_EVENT_KINDS = {
+    'radar.early_fraud_warning.created': 'early-fraud-warning',
+    'review.opened': 'radar-review',
+    'charge.dispute.created': 'dispute'
+};
+const refOf = (value)=>{
+    var _ref;
+    return typeof value === 'string' ? value : String((_ref = value == null ? void 0 : value.id) != null ? _ref : '');
+};
+/**
+ * The signal an event carries, or null for any other event. Every one of
+ * the three objects names its `charge` and `payment_intent`, which is how a
+ * plugin finds its own record.
+ */ export function paymentRiskEventFrom(type, object, nowMs = Date.now()) {
+    var _source_id, _ref, _ref1, _source_fraud_type;
+    const kind = PAYMENT_RISK_EVENT_KINDS[type];
+    if (!kind) return null;
+    const source = object != null ? object : {};
+    const stripeObjectId = String((_source_id = source['id']) != null ? _source_id : '');
+    if (!stripeObjectId) return null;
+    const detail = String((_ref = (_ref1 = (_source_fraud_type = source['fraud_type']) != null ? _source_fraud_type : source['reason']) != null ? _ref1 : source['opened_reason']) != null ? _ref : '');
+    const createdSeconds = Number(source['created']);
+    return {
+        signal: _extends({
+            kind,
+            stripeObjectId
+        }, detail ? {
+            detail
+        } : {}, {
+            atMs: Number.isFinite(createdSeconds) && createdSeconds > 0 ? createdSeconds * 1000 : nowMs
+        }),
+        paymentIntentId: refOf(source['payment_intent']),
+        chargeId: refOf(source['charge'])
+    };
+}
+/**
+ * The field with `signal` added, or null when this signal is already on it
+ * — the redelivery answer, so the caller neither writes nor notifies twice.
+ */ export function addPaymentRiskSignal(existing, signal) {
+    const signals = Array.isArray(existing == null ? void 0 : existing.signals) ? existing.signals : [];
+    if (signals.some((entry)=>entry.stripeObjectId === signal.stripeObjectId)) {
+        return null;
+    }
+    const next = [
+        ...signals,
+        signal
+    ].slice(-MAX_SIGNALS);
+    return {
+        signals: next,
+        latestKind: signal.kind,
+        latestAtMs: signal.atMs
+    };
+}
+/**
+ * The field with a dispute's outcome recorded, or null when the dispute is
+ * not on it or already carries that outcome.
+ */ export function settlePaymentRiskDispute(existing, disputeId, outcome) {
+    const signals = Array.isArray(existing == null ? void 0 : existing.signals) ? existing.signals : [];
+    const index = signals.findIndex((entry)=>entry.stripeObjectId === disputeId);
+    if (index < 0 || !outcome || signals[index].outcome === outcome) return null;
+    const next = signals.slice();
+    next[index] = _extends({}, next[index], {
+        outcome
+    });
+    return _extends({}, existing, {
+        signals: next
+    });
+}
+/** Said with every signal, so a warning never reads as money already gone. */ export const NOTHING_MOVED = `${PLATFORM_BRAND_NAME} has not refunded or canceled anything.`;
+const LABEL = {
+    'early-fraud-warning': 'Fraud warning',
+    'radar-review': 'Held for review',
+    dispute: 'Chargeback'
+};
+const ADVICE = {
+    'early-fraud-warning': 'The card issuer reported this payment as possibly fraudulent. It is not a chargeback yet; refunding it in Stripe now usually prevents one. Hold anything not yet shipped or delivered until you are sure.',
+    'radar-review': 'Stripe Radar is holding this payment for review. Approve or refund it in Stripe; it stays held until you do.',
+    dispute: 'The cardholder disputed this payment. Respond in Stripe with your evidence before the deadline, or accept it.'
+};
+/** The merchant-facing title for one signal, e.g. for a notification. */ export function paymentRiskTitle(kind) {
+    return kind === 'early-fraud-warning' ? 'Early fraud warning on a payment' : kind === 'radar-review' ? 'A payment is held for review' : 'A payment was disputed';
+}
+/** The merchant-facing sentence for one signal. */ export function paymentRiskAdvice(kind) {
+    return ADVICE[kind];
+}
+/**
+ * A chip's label and tooltip for the record's latest signal, or null when
+ * there is none. `Nothing was refunded` is said every time: the merchant
+ * must never read a warning as money already gone.
+ */ export function describePaymentRisk(risk) {
+    const signals = Array.isArray(risk == null ? void 0 : risk.signals) ? risk.signals : [];
+    const latest = signals[signals.length - 1];
+    if (!latest) return null;
+    const outcome = latest.outcome ? ` (${latest.outcome.replace(/_/g, ' ')})` : '';
+    const why = latest.detail ? ` Stripe says: ${latest.detail.replace(/_/g, ' ')}.` : '';
+    return {
+        label: `${LABEL[latest.kind]}${outcome}`,
+        detail: `${ADVICE[latest.kind]}${why} ${NOTHING_MOVED}`
+    };
+}
+
+//# sourceMappingURL=payment-risk.js.map

package/src/lib/app-utils/payment-risk.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../../../../../libs/aglyn/src/lib/app-utils/payment-risk.ts"],"sourcesContent":["/**\n * @license\n * Copyright 2026 Aglyn LLC\n *\n * Licensed under the Apache License, Version 2.0 (the \"License\");\n * you may not use this file except in compliance with the License.\n * You may obtain a copy of the License at\n *\n *   http://www.apache.org/licenses/LICENSE-2.0\n *\n * Unless required by applicable law or agreed to in writing, software\n * distributed under the License is distributed on an \"AS IS\" BASIS,\n * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n * See the License for the specific language governing permissions and\n * limitations under the License.\n */\n\n/*==========================================\n * PAYMENT RISK ON A MERCHANT'S RECORD (AGL-3360).\n *\n * Stripe tells us three ways that a card may not be its holder's: an\n * issuer's EARLY FRAUD WARNING, a Radar REVIEW that holds the payment, and a\n * DISPUTE. For a site's own sale — an order, a booking, a membership — the\n * merchant is the one who decides what to do about it, so the signal lands\n * on the record the sale belongs to, in the merchant's own workspace.\n *\n * This is the one shape every plugin stamps (`paymentRisk` on its own\n * document) and the one sentence every plugin renders, so an order chip and\n * a booking chip say the same thing about the same event. Pure and\n * client-safe; the server write is `payment-risk-record.ts` in\n * tenant-data-admin.\n *\n * Nothing here moves money. An early fraud warning is not yet a chargeback,\n * a review can clear, and a dispute can be won: the words tell the merchant\n * what arrived and where to act (Stripe), never that anything was refunded.\n *=========================================*/\n\nimport { PLATFORM_BRAND_NAME } from './platform-brand'\n\n/** Which Stripe signal arrived. */\nexport type PaymentRiskSignalKind =\n  | 'early-fraud-warning'\n  | 'radar-review'\n  | 'dispute'\n\n/** One signal, as stamped on the merchant's record. */\nexport interface PaymentRiskSignal {\n  kind: PaymentRiskSignalKind\n  /** The EFW, review or dispute id: one entry per signal, whatever redelivers. */\n  stripeObjectId: string\n  /** `fraud_type`, the review's `reason`, the dispute's `reason`. */\n  detail?: string\n  /** A dispute's outcome once `charge.dispute.closed` lands. */\n  outcome?: string\n  atMs: number\n}\n\n/** The `paymentRisk` field. */\nexport interface PaymentRisk {\n  signals: PaymentRiskSignal[]\n  latestKind: PaymentRiskSignalKind\n  latestAtMs: number\n}\n\nexport const PAYMENT_RISK_FIELD = 'paymentRisk'\n\n/** Bounded so a pathological charge cannot grow a document without end. */\nconst MAX_SIGNALS = 20\n\n/** The Stripe events that carry a signal, and which kind each is. */\nexport const PAYMENT_RISK_EVENT_KINDS: Readonly<\n  Record<string, PaymentRiskSignalKind>\n> = {\n  'radar.early_fraud_warning.created': 'early-fraud-warning',\n  'review.opened': 'radar-review',\n  'charge.dispute.created': 'dispute',\n}\n\n/** What a webhook handler needs from one of those events. */\nexport interface PaymentRiskEvent {\n  signal: PaymentRiskSignal\n  paymentIntentId: string\n  chargeId: string\n}\n\nconst refOf = (value: unknown): string =>\n  typeof value === 'string'\n    ? value\n    : String((value as { id?: unknown } | null)?.id ?? '')\n\n/**\n * The signal an event carries, or null for any other event. Every one of\n * the three objects names its `charge` and `payment_intent`, which is how a\n * plugin finds its own record.\n */\nexport function paymentRiskEventFrom(\n  type: string,\n  object: unknown,\n  nowMs = Date.now(),\n): PaymentRiskEvent | null {\n  const kind = PAYMENT_RISK_EVENT_KINDS[type]\n  if (!kind) return null\n  const source = (object ?? {}) as Record<string, unknown>\n  const stripeObjectId = String(source['id'] ?? '')\n  if (!stripeObjectId) return null\n  const detail = String(\n    source['fraud_type'] ?? source['reason'] ?? source['opened_reason'] ?? '',\n  )\n  const createdSeconds = Number(source['created'])\n  return {\n    signal: {\n      kind,\n      stripeObjectId,\n      ...(detail ? { detail } : {}),\n      atMs:\n        Number.isFinite(createdSeconds) && createdSeconds > 0\n          ? createdSeconds * 1000\n          : nowMs,\n    },\n    paymentIntentId: refOf(source['payment_intent']),\n    chargeId: refOf(source['charge']),\n  }\n}\n\n/**\n * The field with `signal` added, or null when this signal is already on it\n * — the redelivery answer, so the caller neither writes nor notifies twice.\n */\nexport function addPaymentRiskSignal(\n  existing: PaymentRisk | null | undefined,\n  signal: PaymentRiskSignal,\n): PaymentRisk | null {\n  const signals = Array.isArray(existing?.signals) ? existing.signals : []\n  if (signals.some((entry) => entry.stripeObjectId === signal.stripeObjectId)) {\n    return null\n  }\n  const next = [...signals, signal].slice(-MAX_SIGNALS)\n  return { signals: next, latestKind: signal.kind, latestAtMs: signal.atMs }\n}\n\n/**\n * The field with a dispute's outcome recorded, or null when the dispute is\n * not on it or already carries that outcome.\n */\nexport function settlePaymentRiskDispute(\n  existing: PaymentRisk | null | undefined,\n  disputeId: string,\n  outcome: string,\n): PaymentRisk | null {\n  const signals = Array.isArray(existing?.signals) ? existing.signals : []\n  const index = signals.findIndex((entry) => entry.stripeObjectId === disputeId)\n  if (index < 0 || !outcome || signals[index].outcome === outcome) return null\n  const next = signals.slice()\n  next[index] = { ...next[index], outcome }\n  return { ...(existing as PaymentRisk), signals: next }\n}\n\n/** Said with every signal, so a warning never reads as money already gone. */\nexport const NOTHING_MOVED = `${PLATFORM_BRAND_NAME} has not refunded or canceled anything.`\n\nconst LABEL: Record<PaymentRiskSignalKind, string> = {\n  'early-fraud-warning': 'Fraud warning',\n  'radar-review': 'Held for review',\n  dispute: 'Chargeback',\n}\n\nconst ADVICE: Record<PaymentRiskSignalKind, string> = {\n  'early-fraud-warning':\n    'The card issuer reported this payment as possibly fraudulent. It is not a chargeback yet; refunding it in Stripe now usually prevents one. Hold anything not yet shipped or delivered until you are sure.',\n  'radar-review':\n    'Stripe Radar is holding this payment for review. Approve or refund it in Stripe; it stays held until you do.',\n  dispute:\n    'The cardholder disputed this payment. Respond in Stripe with your evidence before the deadline, or accept it.',\n}\n\n/** The merchant-facing title for one signal, e.g. for a notification. */\nexport function paymentRiskTitle(kind: PaymentRiskSignalKind): string {\n  return kind === 'early-fraud-warning'\n    ? 'Early fraud warning on a payment'\n    : kind === 'radar-review'\n      ? 'A payment is held for review'\n      : 'A payment was disputed'\n}\n\n/** The merchant-facing sentence for one signal. */\nexport function paymentRiskAdvice(kind: PaymentRiskSignalKind): string {\n  return ADVICE[kind]\n}\n\n/**\n * A chip's label and tooltip for the record's latest signal, or null when\n * there is none. `Nothing was refunded` is said every time: the merchant\n * must never read a warning as money already gone.\n */\nexport function describePaymentRisk(\n  risk: PaymentRisk | null | undefined,\n): { label: string; detail: string } | null {\n  const signals = Array.isArray(risk?.signals) ? risk.signals : []\n  const latest = signals[signals.length - 1]\n  if (!latest) return null\n  const outcome = latest.outcome ? ` (${latest.outcome.replace(/_/g, ' ')})` : ''\n  const why = latest.detail ? ` Stripe says: ${latest.detail.replace(/_/g, ' ')}.` : ''\n  return {\n    label: `${LABEL[latest.kind]}${outcome}`,\n    detail: `${ADVICE[latest.kind]}${why} ${NOTHING_MOVED}`,\n  }\n}\n"],"names":["PLATFORM_BRAND_NAME","PAYMENT_RISK_FIELD","MAX_SIGNALS","PAYMENT_RISK_EVENT_KINDS","refOf","value","String","id","paymentRiskEventFrom","type","object","nowMs","Date","now","source","kind","stripeObjectId","detail","createdSeconds","Number","signal","atMs","isFinite","paymentIntentId","chargeId","addPaymentRiskSignal","existing","signals","Array","isArray","some","entry","next","slice","latestKind","latestAtMs","settlePaymentRiskDispute","disputeId","outcome","index","findIndex","NOTHING_MOVED","LABEL","dispute","ADVICE","paymentRiskTitle","paymentRiskAdvice","describePaymentRisk","risk","latest","length","replace","why","label"],"mappings":";AAAA;;;;;;;;;;;;;;;CAeC,GAED;;;;;;;;;;;;;;;;;;2CAkB2C,GAE3C,SAASA,mBAAmB,QAAQ,sBAAkB;AA2BtD,OAAO,MAAMC,qBAAqB,cAAa;AAE/C,yEAAyE,GACzE,MAAMC,cAAc;AAEpB,mEAAmE,GACnE,OAAO,MAAMC,2BAET;IACF,qCAAqC;IACrC,iBAAiB;IACjB,0BAA0B;AAC5B,EAAC;AASD,MAAMC,QAAQ,CAACC;;WACb,OAAOA,UAAU,WACbA,QACAC,eAAQD,yBAAD,AAACA,MAAmCE,EAAE,mBAAI;;AAEvD;;;;CAIC,GACD,OAAO,SAASC,qBACdC,IAAY,EACZC,MAAe,EACfC,QAAQC,KAAKC,GAAG,EAAE;QAKYC,YAG5BA,MAAAA,OAAAA;IANF,MAAMC,OAAOZ,wBAAwB,CAACM,KAAK;IAC3C,IAAI,CAACM,MAAM,OAAO;IAClB,MAAMD,SAAUJ,iBAAAA,SAAU,CAAC;IAC3B,MAAMM,iBAAiBV,QAAOQ,aAAAA,MAAM,CAAC,KAAK,YAAZA,aAAgB;IAC9C,IAAI,CAACE,gBAAgB,OAAO;IAC5B,MAAMC,SAASX,QACbQ,QAAAA,SAAAA,qBAAAA,MAAM,CAAC,aAAa,YAApBA,qBAAwBA,MAAM,CAAC,SAAS,YAAxCA,QAA4CA,MAAM,CAAC,gBAAgB,YAAnEA,OAAuE;IAEzE,MAAMI,iBAAiBC,OAAOL,MAAM,CAAC,UAAU;IAC/C,OAAO;QACLM,QAAQ;YACNL;YACAC;WACIC,SAAS;YAAEA;QAAO,IAAI,CAAC;YAC3BI,MACEF,OAAOG,QAAQ,CAACJ,mBAAmBA,iBAAiB,IAChDA,iBAAiB,OACjBP;;QAERY,iBAAiBnB,MAAMU,MAAM,CAAC,iBAAiB;QAC/CU,UAAUpB,MAAMU,MAAM,CAAC,SAAS;IAClC;AACF;AAEA;;;CAGC,GACD,OAAO,SAASW,qBACdC,QAAwC,EACxCN,MAAyB;IAEzB,MAAMO,UAAUC,MAAMC,OAAO,CAACH,4BAAAA,SAAUC,OAAO,IAAID,SAASC,OAAO,GAAG,EAAE;IACxE,IAAIA,QAAQG,IAAI,CAAC,CAACC,QAAUA,MAAMf,cAAc,KAAKI,OAAOJ,cAAc,GAAG;QAC3E,OAAO;IACT;IACA,MAAMgB,OAAO;WAAIL;QAASP;KAAO,CAACa,KAAK,CAAC,CAAC/B;IACzC,OAAO;QAAEyB,SAASK;QAAME,YAAYd,OAAOL,IAAI;QAAEoB,YAAYf,OAAOC,IAAI;IAAC;AAC3E;AAEA;;;CAGC,GACD,OAAO,SAASe,yBACdV,QAAwC,EACxCW,SAAiB,EACjBC,OAAe;IAEf,MAAMX,UAAUC,MAAMC,OAAO,CAACH,4BAAAA,SAAUC,OAAO,IAAID,SAASC,OAAO,GAAG,EAAE;IACxE,MAAMY,QAAQZ,QAAQa,SAAS,CAAC,CAACT,QAAUA,MAAMf,cAAc,KAAKqB;IACpE,IAAIE,QAAQ,KAAK,CAACD,WAAWX,OAAO,CAACY,MAAM,CAACD,OAAO,KAAKA,SAAS,OAAO;IACxE,MAAMN,OAAOL,QAAQM,KAAK;IAC1BD,IAAI,CAACO,MAAM,GAAG,aAAKP,IAAI,CAACO,MAAM;QAAED;;IAChC,OAAO,aAAMZ;QAA0BC,SAASK;;AAClD;AAEA,4EAA4E,GAC5E,OAAO,MAAMS,gBAAgB,GAAGzC,oBAAoB,uCAAuC,CAAC,CAAA;AAE5F,MAAM0C,QAA+C;IACnD,uBAAuB;IACvB,gBAAgB;IAChBC,SAAS;AACX;AAEA,MAAMC,SAAgD;IACpD,uBACE;IACF,gBACE;IACFD,SACE;AACJ;AAEA,uEAAuE,GACvE,OAAO,SAASE,iBAAiB9B,IAA2B;IAC1D,OAAOA,SAAS,wBACZ,qCACAA,SAAS,iBACP,iCACA;AACR;AAEA,iDAAiD,GACjD,OAAO,SAAS+B,kBAAkB/B,IAA2B;IAC3D,OAAO6B,MAAM,CAAC7B,KAAK;AACrB;AAEA;;;;CAIC,GACD,OAAO,SAASgC,oBACdC,IAAoC;IAEpC,MAAMrB,UAAUC,MAAMC,OAAO,CAACmB,wBAAAA,KAAMrB,OAAO,IAAIqB,KAAKrB,OAAO,GAAG,EAAE;IAChE,MAAMsB,SAAStB,OAAO,CAACA,QAAQuB,MAAM,GAAG,EAAE;IAC1C,IAAI,CAACD,QAAQ,OAAO;IACpB,MAAMX,UAAUW,OAAOX,OAAO,GAAG,CAAC,EAAE,EAAEW,OAAOX,OAAO,CAACa,OAAO,CAAC,MAAM,KAAK,CAAC,CAAC,GAAG;IAC7E,MAAMC,MAAMH,OAAOhC,MAAM,GAAG,CAAC,cAAc,EAAEgC,OAAOhC,MAAM,CAACkC,OAAO,CAAC,MAAM,KAAK,CAAC,CAAC,GAAG;IACnF,OAAO;QACLE,OAAO,GAAGX,KAAK,CAACO,OAAOlC,IAAI,CAAC,GAAGuB,SAAS;QACxCrB,QAAQ,GAAG2B,MAAM,CAACK,OAAOlC,IAAI,CAAC,GAAGqC,IAAI,CAAC,EAAEX,eAAe;IACzD;AACF"}

package/src/lib/app-utils/plugin-api-request-host.d.ts

@@ -0,0 +1,29 @@
+/**
+ * @license
+ * Copyright 2026 Aglyn LLC
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+export interface PluginApiRequestHost {
+    /** The one site the request names, or '' when it names none. */
+    hostId: string;
+    /** True when the query and the body (or repeated params) disagree. */
+    conflict: boolean;
+}
+/**
+ * Every site the request names, read off a clone so the handler still gets
+ * the untouched stream. Never throws: an unreadable body names no site.
+ */
+export declare function pluginApiRequestHost(request: Request): Promise<PluginApiRequestHost>;
+/** The dispatcher's answer to a conflict: refuse, and say why. */
+export declare function conflictingHostIdResponse(): Response;

package/src/lib/app-utils/plugin-api-request-host.js

@@ -0,0 +1,90 @@
+/**
+ * @license
+ * Copyright 2026 Aglyn LLC
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */ /*==========================================
+ * WHICH SITE A PLUGIN API REQUEST IS ABOUT (AGL-3360).
+ *
+ * Both plugin API dispatchers gate a request on its site — per-site plugin
+ * enablement, the org/host lockdown, the visitor rate limit — and then hand
+ * the request to a handler that reads the site AGAIN, its own way. The two
+ * readings disagreed in two ways, and each let a suspended site take money:
+ *
+ * 1. `?hostId=` won over the body. A checkout posted with
+ *    `?hostId=<any open site>` and `{"hostId": "<suspended site>"}` was
+ *    gated on the open site and charged for the suspended one: every
+ *    storefront, booking and reservation handler reads `body.hostId`.
+ * 2. Only a JSON body was read. A urlencoded body parsed to nothing here,
+ *    so no gate ran at all, while `pluginRequestFromWeb` hands the handler
+ *    the form fields as an object and `body.hostId` is right there.
+ *
+ * This reads the request exactly as `pluginRequestFromWeb` will present it
+ * to the handler — form fields for urlencoded, JSON for anything that
+ * parses as JSON (handlers `JSON.parse` a string body themselves) — and
+ * collects EVERY hostId the request names. More than one distinct site is
+ * a conflict the dispatcher refuses: no honest caller names two sites, and
+ * any single choice between them is a guess an attacker gets to make.
+ *
+ * Coerced with `String(value ?? '')`, the handlers' own coercion, so the
+ * site gated is the site charged byte for byte.
+ *=========================================*/ function bodyHostId(raw, contentType) {
+    if (!raw) return '';
+    if (contentType.includes('application/x-www-form-urlencoded')) {
+        var _get;
+        return String((_get = new URLSearchParams(raw).get('hostId')) != null ? _get : '');
+    }
+    try {
+        var _parsed_hostId;
+        const parsed = JSON.parse(raw);
+        return parsed && typeof parsed === 'object' ? String((_parsed_hostId = parsed.hostId) != null ? _parsed_hostId : '') : '';
+    } catch (unused) {
+        return '';
+    }
+}
+/**
+ * Every site the request names, read off a clone so the handler still gets
+ * the untouched stream. Never throws: an unreadable body names no site.
+ */ export async function pluginApiRequestHost(request) {
+    var _request_method;
+    const named = new Set();
+    const url = new URL(request.url);
+    for (const value of url.searchParams.getAll('hostId')){
+        if (value) named.add(value);
+    }
+    const method = ((_request_method = request.method) != null ? _request_method : 'GET').toUpperCase();
+    if (method !== 'GET' && method !== 'HEAD') {
+        try {
+            var _request_headers_get;
+            const raw = await request.clone().text();
+            const fromBody = bodyHostId(raw, (_request_headers_get = request.headers.get('content-type')) != null ? _request_headers_get : '');
+            if (fromBody) named.add(fromBody);
+        } catch (unused) {
+        // An unreadable body names no site; the handler cannot read one either.
+        }
+    }
+    const [first = ''] = named;
+    return {
+        hostId: named.size === 1 ? first : '',
+        conflict: named.size > 1
+    };
+}
+/** The dispatcher's answer to a conflict: refuse, and say why. */ export function conflictingHostIdResponse() {
+    return Response.json({
+        error: 'The request names more than one site.'
+    }, {
+        status: 400
+    });
+}
+
+//# sourceMappingURL=plugin-api-request-host.js.map

package/src/lib/app-utils/plugin-api-request-host.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../../../../../libs/aglyn/src/lib/app-utils/plugin-api-request-host.ts"],"sourcesContent":["/**\n * @license\n * Copyright 2026 Aglyn LLC\n *\n * Licensed under the Apache License, Version 2.0 (the \"License\");\n * you may not use this file except in compliance with the License.\n * You may obtain a copy of the License at\n *\n *   http://www.apache.org/licenses/LICENSE-2.0\n *\n * Unless required by applicable law or agreed to in writing, software\n * distributed under the License is distributed on an \"AS IS\" BASIS,\n * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n * See the License for the specific language governing permissions and\n * limitations under the License.\n */\n\n/*==========================================\n * WHICH SITE A PLUGIN API REQUEST IS ABOUT (AGL-3360).\n *\n * Both plugin API dispatchers gate a request on its site — per-site plugin\n * enablement, the org/host lockdown, the visitor rate limit — and then hand\n * the request to a handler that reads the site AGAIN, its own way. The two\n * readings disagreed in two ways, and each let a suspended site take money:\n *\n * 1. `?hostId=` won over the body. A checkout posted with\n *    `?hostId=<any open site>` and `{\"hostId\": \"<suspended site>\"}` was\n *    gated on the open site and charged for the suspended one: every\n *    storefront, booking and reservation handler reads `body.hostId`.\n * 2. Only a JSON body was read. A urlencoded body parsed to nothing here,\n *    so no gate ran at all, while `pluginRequestFromWeb` hands the handler\n *    the form fields as an object and `body.hostId` is right there.\n *\n * This reads the request exactly as `pluginRequestFromWeb` will present it\n * to the handler — form fields for urlencoded, JSON for anything that\n * parses as JSON (handlers `JSON.parse` a string body themselves) — and\n * collects EVERY hostId the request names. More than one distinct site is\n * a conflict the dispatcher refuses: no honest caller names two sites, and\n * any single choice between them is a guess an attacker gets to make.\n *\n * Coerced with `String(value ?? '')`, the handlers' own coercion, so the\n * site gated is the site charged byte for byte.\n *=========================================*/\n\nexport interface PluginApiRequestHost {\n  /** The one site the request names, or '' when it names none. */\n  hostId: string\n  /** True when the query and the body (or repeated params) disagree. */\n  conflict: boolean\n}\n\nfunction bodyHostId(raw: string, contentType: string): string {\n  if (!raw) return ''\n  if (contentType.includes('application/x-www-form-urlencoded')) {\n    return String(new URLSearchParams(raw).get('hostId') ?? '')\n  }\n  try {\n    const parsed = JSON.parse(raw) as { hostId?: unknown } | null\n    return parsed && typeof parsed === 'object'\n      ? String(parsed.hostId ?? '')\n      : ''\n  } catch {\n    return ''\n  }\n}\n\n/**\n * Every site the request names, read off a clone so the handler still gets\n * the untouched stream. Never throws: an unreadable body names no site.\n */\nexport async function pluginApiRequestHost(\n  request: Request,\n): Promise<PluginApiRequestHost> {\n  const named = new Set<string>()\n  const url = new URL(request.url)\n  for (const value of url.searchParams.getAll('hostId')) {\n    if (value) named.add(value)\n  }\n  const method = (request.method ?? 'GET').toUpperCase()\n  if (method !== 'GET' && method !== 'HEAD') {\n    try {\n      const raw = await request.clone().text()\n      const fromBody = bodyHostId(\n        raw,\n        request.headers.get('content-type') ?? '',\n      )\n      if (fromBody) named.add(fromBody)\n    } catch {\n      // An unreadable body names no site; the handler cannot read one either.\n    }\n  }\n  const [first = ''] = named\n  return { hostId: named.size === 1 ? first : '', conflict: named.size > 1 }\n}\n\n/** The dispatcher's answer to a conflict: refuse, and say why. */\nexport function conflictingHostIdResponse(): Response {\n  return Response.json(\n    { error: 'The request names more than one site.' },\n    { status: 400 },\n  )\n}\n"],"names":["bodyHostId","raw","contentType","includes","String","URLSearchParams","get","parsed","JSON","parse","hostId","pluginApiRequestHost","request","named","Set","url","URL","value","searchParams","getAll","add","method","toUpperCase","clone","text","fromBody","headers","first","size","conflict","conflictingHostIdResponse","Response","json","error","status"],"mappings":"AAAA;;;;;;;;;;;;;;;CAeC,GAED;;;;;;;;;;;;;;;;;;;;;;;;;2CAyB2C,GAS3C,SAASA,WAAWC,GAAW,EAAEC,WAAmB;IAClD,IAAI,CAACD,KAAK,OAAO;IACjB,IAAIC,YAAYC,QAAQ,CAAC,sCAAsC;YAC/C;QAAd,OAAOC,QAAO,OAAA,IAAIC,gBAAgBJ,KAAKK,GAAG,CAAC,qBAA7B,OAA0C;IAC1D;IACA,IAAI;YAGSC;QAFX,MAAMA,SAASC,KAAKC,KAAK,CAACR;QAC1B,OAAOM,UAAU,OAAOA,WAAW,WAC/BH,QAAOG,iBAAAA,OAAOG,MAAM,YAAbH,iBAAiB,MACxB;IACN,EAAE,eAAM;QACN,OAAO;IACT;AACF;AAEA;;;CAGC,GACD,OAAO,eAAeI,qBACpBC,OAAgB;QAOAA;IALhB,MAAMC,QAAQ,IAAIC;IAClB,MAAMC,MAAM,IAAIC,IAAIJ,QAAQG,GAAG;IAC/B,KAAK,MAAME,SAASF,IAAIG,YAAY,CAACC,MAAM,CAAC,UAAW;QACrD,IAAIF,OAAOJ,MAAMO,GAAG,CAACH;IACvB;IACA,MAAMI,SAAS,EAACT,kBAAAA,QAAQS,MAAM,YAAdT,kBAAkB,OAAOU,WAAW;IACpD,IAAID,WAAW,SAASA,WAAW,QAAQ;QACzC,IAAI;gBAIAT;YAHF,MAAMX,MAAM,MAAMW,QAAQW,KAAK,GAAGC,IAAI;YACtC,MAAMC,WAAWzB,WACfC,MACAW,uBAAAA,QAAQc,OAAO,CAACpB,GAAG,CAAC,2BAApBM,uBAAuC;YAEzC,IAAIa,UAAUZ,MAAMO,GAAG,CAACK;QAC1B,EAAE,eAAM;QACN,wEAAwE;QAC1E;IACF;IACA,MAAM,CAACE,QAAQ,EAAE,CAAC,GAAGd;IACrB,OAAO;QAAEH,QAAQG,MAAMe,IAAI,KAAK,IAAID,QAAQ;QAAIE,UAAUhB,MAAMe,IAAI,GAAG;IAAE;AAC3E;AAEA,gEAAgE,GAChE,OAAO,SAASE;IACd,OAAOC,SAASC,IAAI,CAClB;QAAEC,OAAO;IAAwC,GACjD;QAAEC,QAAQ;IAAI;AAElB"}

package/src/lib/app-utils/plugin-bundle-checks.d.ts

@@ -16,7 +16,7 @@
  */
 import type { PluginContributions } from '../plugin-manager/plugin-contributions';
 /** The areas the verifier reports on, in the order a reviewer reads them. */
-export type BundleCheckId = 'parse' | 'entry' | 'self-contained' | 'size' | 'code-execution' | 'globals' | 'storage' | 'dynamic-import' | 'network' | 'obfuscation' | 'contributions';
+export type BundleCheckId = 'parse' | 'entry' | 'self-contained' | 'size' | 'code-execution' | 'globals' | 'storage' | 'dynamic-import' | 'network' | 'obfuscation' | 'contributions' | 'credentials';
 export interface BundleCheckProblem {
     level: 'error' | 'warning';
     message: string;
@@ -85,8 +85,9 @@ export declare const MAX_PLUGIN_BUNDLE_BYTES = 1000000;
  * 4 — calls through an alias are resolved (AGL-1090).
  * 5 — URLs held in a constant are resolved (AGL-1093).
  * 6 — registrations are compared with the declared contributions (AGL-3116).
+ * 7 — inputs that collect a password, card or one-time code (AGL-3362).
  */
-export declare const PLUGIN_VERIFIER_VERSION = 6;
+export declare const PLUGIN_VERIFIER_VERSION = 7;
 /** A verdict as stored on a `pluginVersions` doc (AGL-962). */
 export interface StoredBundleVerdict {
     ok?: boolean;

package/src/lib/app-utils/plugin-bundle-checks.js

@@ -34,6 +34,9 @@ import { _ as _extends } from "@swc/helpers/_/_extends";
  * chain (sandbox iframe + per-manifest CSP / staff review + realm signing /
  * sha pinning / the kill switch).
  */ import { parse } from "acorn";
+// The leaf, not the barrel: the phishing screen's own reading of an input's
+// type, autocomplete token and raw HTML (AGL-3362).
+import { credentialForInputAttribute, credentialInHtml } from "@aglyn/shared-util-email/hosted-page-screen";
 const CHECK_LABELS = {
     parse: 'Parses as an ES module',
     entry: 'Exports an entry point',
@@ -45,7 +48,8 @@ const CHECK_LABELS = {
     'dynamic-import': 'No dynamic import of unknown code',
     network: 'Network calls match the manifest',
     obfuscation: 'No obfuscation shapes',
-    contributions: 'Registrations match the declared contributions'
+    contributions: 'Registrations match the declared contributions',
+    credentials: 'No password, card or one-time-code inputs'
 };
 /** Check order as displayed — findings first would reorder on every bundle. */ const CHECK_ORDER = [
     'parse',
@@ -58,7 +62,8 @@ const CHECK_LABELS = {
     'dynamic-import',
     'network',
     'obfuscation',
-    'contributions'
+    'contributions',
+    'credentials'
 ];
 export const MAX_PLUGIN_BUNDLE_BYTES = 1000000;
 /**
@@ -77,7 +82,8 @@ export const MAX_PLUGIN_BUNDLE_BYTES = 1000000;
  * 4 — calls through an alias are resolved (AGL-1090).
  * 5 — URLs held in a constant are resolved (AGL-1093).
  * 6 — registrations are compared with the declared contributions (AGL-3116).
- */ export const PLUGIN_VERIFIER_VERSION = 6;
+ * 7 — inputs that collect a password, card or one-time code (AGL-3362).
+ */ export const PLUGIN_VERIFIER_VERSION = 7;
 /**
  * Whether a stored verdict may be served instead of re-running the checks.
  *
@@ -505,6 +511,68 @@ const BASE64_BLOB = /^[A-Za-z0-9+/\r\n]+={0,2}$/;
     unused('the site feature', (_declared_site3 = declared.site) == null ? void 0 : _declared_site3.features, (_found_site3 = found.site) == null ? void 0 : _found_site3.features);
     unused('the console slot', (_declared_console4 = declared.console) == null ? void 0 : _declared_console4.slots, (_found_console4 = found.console) == null ? void 0 : _found_console4.slots);
 }
+/**
+ * Inputs a bundle builds that collect a password, a card number or a
+ * one-time code (AGL-3362) — a reviewer's QUESTION, never a failure.
+ *
+ * The phishing screen holds a published page whose author defined such a
+ * field, but a plugin renders its own inputs from code the page screen never
+ * reads. So the same reading is applied here, to the bundle, at review: an
+ * input's `type` or `autocomplete` in an object literal (`createElement`
+ * props, a JSX runtime call, a DOM `Object.assign`), in `setAttribute`, and
+ * in any HTML string. A warning rather than an error because a legitimate
+ * plugin can own a sign-in (a members-only area, a booking account); what the
+ * reviewer asks is whether its credentials go anywhere but its declared
+ * origins. The sandbox tier cannot post a native form at all — its frame
+ * has no `allow-forms` and its CSP says `form-action 'none'` — so the
+ * question is about `connect-src`, which the network check already lists.
+ */ function credentialInputsIn(program, constants) {
+    const found = new Set();
+    const keyOf = (node)=>{
+        const key = node['key'];
+        if (!key) return null;
+        if (!node['computed'] && key.type === 'Identifier') return key['name'];
+        return staticString(key, constants);
+    };
+    walk(program, (node)=>{
+        if (node.type === 'Property') {
+            const key = keyOf(node);
+            const value = staticString(node['value'], constants);
+            const field = key && value !== null ? credentialForInputAttribute(key, value) : null;
+            if (field) found.add(field);
+        } else if (node.type === 'CallExpression') {
+            var _node_arguments;
+            const callee = node['callee'];
+            const args = (_node_arguments = node['arguments']) != null ? _node_arguments : [];
+            if ((callee == null ? void 0 : callee.type) === 'MemberExpression' && propertyName(callee, constants) === 'setAttribute') {
+                const name = staticString(args[0], constants);
+                const value = staticString(args[1], constants);
+                const field = name !== null && value !== null ? credentialForInputAttribute(name, value) : null;
+                if (field) found.add(field);
+            }
+        } else if (node.type === 'Literal' && typeof node['value'] === 'string') {
+            const field = credentialInHtml(node['value']);
+            if (field) found.add(field);
+        } else if (node.type === 'TemplateLiteral') {
+            var _node_quasis;
+            const text = ((_node_quasis = node['quasis']) != null ? _node_quasis : []).map((quasi)=>{
+                var _ref;
+                var _quasi_value;
+                return String((_ref = (_quasi_value = quasi['value']) == null ? void 0 : _quasi_value.cooked) != null ? _ref : '');
+            }).join('');
+            const field = credentialInHtml(text);
+            if (field) found.add(field);
+        }
+    });
+    const words = {
+        password: 'a password',
+        card: 'a card number or security code',
+        otp: 'a one-time code'
+    };
+    return [
+        ...found
+    ].map((field)=>`builds an input that collects ${words[field]} — confirm what it is for, and that ` + 'it is sent only to the origins the manifest declares');
+}
 function analyseBundle(source, options) {
     var _ref;
     const problems = [];
@@ -545,7 +613,7 @@ function analyseBundle(source, options) {
     details.set('size', `${bytes.toLocaleString('en-US')} bytes of ${maxBytes.toLocaleString('en-US')}`);
     if (bytes === 0) {
         add('error', 'size', 'bundle is empty');
-        unknownFrom('parse', 'entry', 'self-contained', 'code-execution', 'globals', 'storage', 'dynamic-import', 'network', 'obfuscation', 'contributions');
+        unknownFrom('parse', 'entry', 'self-contained', 'code-execution', 'globals', 'storage', 'dynamic-import', 'network', 'obfuscation', 'contributions', 'credentials');
         return {
             ok: false,
             problems,
@@ -574,7 +642,7 @@ function analyseBundle(source, options) {
         // Nothing else ran, and saying so is the whole point of `unknown`: a
         // bundle nobody could read must not show nine green rows.
         add('error', 'parse', `bundle does not parse as an ES module: ${error instanceof Error ? error.message : String(error)}`);
-        unknownFrom('entry', 'self-contained', 'code-execution', 'globals', 'storage', 'dynamic-import', 'network', 'obfuscation', 'contributions');
+        unknownFrom('entry', 'self-contained', 'code-execution', 'globals', 'storage', 'dynamic-import', 'network', 'obfuscation', 'contributions', 'credentials');
         return {
             ok: false,
             problems,
@@ -939,6 +1007,9 @@ function analyseBundle(source, options) {
         ].filter(Boolean).join(' · '));
     }
     const detected = detectRegistrations(program, constants);
+    for (const message of credentialInputsIn(program, constants)){
+        add('warning', 'credentials', message);
+    }
     compareContributions(detected, options, add, details, (check)=>status.set(check, 'unknown'));
     return {
         ok: !problems.some((problem)=>problem.level === 'error'),